Dutch Vulnerability Disclosure Nonprofit DIVD Says Two Zammad Zero-Days Enabled an AI-Agent-Driven Breach
DIVD says attackers chained two Zammad zero-days (CVE-2026-102489, CVE-2026-102490) and used an automated AI agent; volunteer data was exposed.
Overview
The Dutch Institute for Vulnerability Disclosure (DIVD), a nonprofit of volunteer security researchers, has said it was breached through two previously unknown vulnerabilities in the open-source Zammad ticketing system, in an intrusion it assesses to be driven by an AI agent. According to SecurityWeek, the attack exploited two zero-day flaws in Zammad. DIVD’s own incident casefile says the modus operandi “indicates an agentic AI powered attack, something we had not seen before.”
What We Know
The organization. BleepingComputer describes DIVD as a nonprofit organization of volunteer security researchers that scans the internet for systems affected by known vulnerabilities, notifies their owners, and provides information on how to mitigate the risks. The outlet reports the organization said it had been hacked after seven years of uneventful operations.
Timeline per DIVD. The casefile timeline lists first access by a malicious actor on DIVD systems on 21 September 2026. On 22 September 2026, DIVD became aware of malicious activity and access to all systems in the datacenter was blocked; the same timeline records that a forensic investigation was started together with Merlon Security. The vulnerability was reported to Zammad on 24 September 2026, the date of DIVD’s first public statement on LinkedIn, and a limited disclosure for the two CVEs was created on 26 September 2026.
The vulnerabilities. DIVD’s Zammad casefile (DIVD-2026-00015) tracks two CVEs:
- CVE-2026-102489: a session hijack vulnerability in Zammad versions 6.3.0 to 6.5.4 that leads to remote code execution as the zammad user. DIVD says the flaw is also present in versions 7.0.0 to 7.1.3 but is “not exploitable due to environment conditions.”
- CVE-2026-102490: a vulnerability in all Zammad versions, including the latest alpha, that lets the local zammad user escalate privileges to root. The casefile’s version field lists v1.5.0 to v7.1.0-alpha for this flaw.
SecurityWeek reports a CVSS score of 9.4 for each: the first lets unauthenticated attackers achieve remote code execution and leak user sessions, and the second allows a local user to elevate privileges to root. In DIVD’s words, quoted by SecurityWeek, used together the flaws “allowed the attackers to hijack sessions, run code remotely, and escalate privileges from the Zammad user to root, in seconds, due to the agentic part of this hack.”
Why DIVD calls it agentic. In a statement dated 26 September 2026, DIVD said the attacker’s scripts contain notes in which the agent justifies its own actions, “something a human attacker wouldn’t bother with.” On 29 September, DIVD described the attack as “loud and very messy,” with the agent working automated and deciding each next step itself, and said the agent’s “overexplaining comments” made reverse engineering easier. BleepingComputer adds that, according to the researchers, the agent did “some pretty dumb things,” including interfering with its own adversary-in-the-middle attack via password spraying, and that DIVD believes the agent was poorly trained and configured for such operations. DIVD also said it sees no link to any known public threat actor.
Impact. SecurityWeek reports the hackers pivoted from the Zammad instance to other services and exfiltrated data, but network segmentation prevented them from going deeper. In its 1 October statement, DIVD said volunteer data got out, such as DIVD email addresses and possibly contact details, which makes it easier for someone to pose as a DIVD volunteer; it asks anyone who receives an off-feeling message from DIVD to check at [email protected] first.
What Zammad users should do. DIVD advises all Zammad users to upgrade to version 7 or take the system offline, and has published a log check script to look for indicators of compromise in Zammad logfiles. SecurityWeek reports DIVD is actively scanning for vulnerable Zammad instances and alerting their owners.
What We Don’t Know
- Which data was taken. DIVD says whose data and exactly which data is still being investigated, and that it has found signs of compromise it is still examining. Until it can prove otherwise, it assumes breach.
- How the AI involvement was established. The agentic characterization is DIVD’s assessment based on its logs and the attacker’s scripts; only two redacted log screenshots have been shared, and DIVD said it could not share more without getting in the way of the investigation. No independent forensic confirmation has been published in the sources reviewed.
- Who is behind it. DIVD says it sees no link to any known public threat actor, and it has not said that it has identified the operator.
- How the zero-days were found. None of the cited sources says how the attacker discovered the two Zammad flaws, or whether an AI system was involved in that step rather than only in post-exploitation activity.
Analysis
Two points stand out for developers and defenders. First, the initial access came from ordinary software flaws in a widely deployed open-source help-desk application, chained together; the AI element described by DIVD concerns the speed and automation of what followed (“in seconds”), not a new class of vulnerability. Second, DIVD’s account suggests that an agent operating with sloppy logic and verbose self-justification left an unusually readable trail, which helped the defenders. Whether better-configured agents would do the same is not something the available reporting can answer.
The incident is separate from, but arrives amid, other recent reports involving AI agents and unauthorized system access, such as the Australian case The Machine Herald previously reported.